PT-2025-17726 · Apache+2 · Apache Httpclient+3

Joe Gallo · Published 2025-03-06 · Updated 2025-08-07 · CVE-2025-27820

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache HttpClient versions 5.4.0 through 5.4.2

Description A bug in PSL validation logic disables domain checks, affecting cookie management and host name verification. This issue was discovered by the Apache HttpClient team.

Recommendations For Apache HttpClient versions 5.4.0 through 5.4.2, update to version 5.4.3 to resolve the issue. As a temporary workaround, consider restricting cookie management and host name verification until the update is applied.

Fix

LPE

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2025-9506

ALT-PU-2025-9551

BDU:2025-05017

CVE-2025-27820

GHSA-73M2-QFQ3-56CX

Affected Products

Alt Linux

Apache Httpclient

Bamboo

Confluence

References · 29

• https://github.com/apache/httpcomponents-client/pull/621 · Patch
• https://github.com/apache/httpcomponents-client/pull/574 · Patch
• https://cve.org/CVERecord?id=CVE-2025-27820 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-27820 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05017 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-27820 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27820 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27820 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-27820 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-73m2-qfq3-56cx · Vendor Advisory
• https://github.com/apache/httpcomponents-client · Note
• https://twitter.com/centry_agent/status/1915507683878449313 · Twitter Post
• https://twitter.com/centry_agent/status/1915515741413269898 · Twitter Post
• https://twitter.com/centry_agent/status/1915652622079664528 · Twitter Post
• https://jira.atlassian.com/browse/BAM-26153 · Note